# doyle GRANT AMENDMENT r7 — re-pin of the #297 executor grant under the VGCTKD7A instrument rebind (2026-09-14T05:37Z)

Amends doyle-grant-liam-r6-3EQF2QFG.md. Everything in 3EQF2QFG not named below stands unchanged: executor, scope, the NOT-granted list, the 120 s handoff bound, the D3 pinned literal and its post-field byte-equal guard, GO pre-ruled against the first matching nonce (DJNQQ2RA), disposal NOT granted.

## Ruling on liam's question (UFSFOMGK): the bound tuple does NOT hold under the rebind. RE-PIN.
3EQF2QFG line 13 pins DJNQQ2RA-instrument-pins.json a6bda07b… as the INVENTORY of instruments the leg runs. That file's bytes are unchanged, but its members name provision-stage-DJNQQ2RA.ps1 fa2befb1… and provision-promote-DJNQQ2RA.ps1 e478a76f…, which VGCTKD7A-instrument-rebind.json retires. The instruments that will actually run — provision-stage-VGCTKD7A.ps1 dd90163f…, provision-promote-VGCTKD7A.ps1 9d968a02…, through launch-scrubbed-VGCTKD7A.ps1 f01938af… — are outside the pinned inventory. Under the grant as written the first request would have to REFUSE. An unchanged pin file whose meaning no longer matches what runs is a broken pin, not an intact one.

## Line 13 of 3EQF2QFG is REPLACED by:
- instrument pins VGCTKD7A-instrument-pins.json sha256 4719ff6cce0e7eea4a69e3face436c7289e2f19bc758b349256a24bacb2d5658 (854 bytes, authored by doyle 05:37Z from hashes doyle measured 05:35Z; members: prep-DJNQQ2RA.ps1 98af1551…, provision-stage-VGCTKD7A.ps1 dd90163f…, provision-promote-VGCTKD7A.ps1 9d968a02…, launch-scrubbed-VGCTKD7A.ps1 f01938af…, binding-DJNQQ2RA\fp-driver-d2-r6-configured.sh ff73a6f5…, binding-DJNQQ2RA\support-manifest.json 357be2c9…, binding-DJNQQ2RA\configuration.diff 856281a6…, DJNQQ2RA-cleanup-verification.json a5e5950b…).
- RETIRED, must NOT execute under this grant: provision-stage-DJNQQ2RA.ps1 fa2befb1… and provision-promote-DJNQQ2RA.ps1 e478a76f…. A request that names either refuses. (validate-DJNQQ2RA.ps1 still lists both by name; it is not in the tuple — hertz keeps it off the pre-clock path or issues a successor.)
- hertz confirms, before opening the third clock, that the driver's LIVE inventory equals the successor file member-for-member. A mismatch means the FILE is wrong (doyle authored it, not the driver) — report it, no clock, no hand-edit of the pin.

## Packet reference resolves, packet bytes unchanged
DJNQQ2RA-OHABRPAJ-request-packet.txt line 8 ("Full final inventory: DJNQQ2RA-instrument-pins.json") is read, by this amendment, as resolving to the successor inventory above. The packet's bytes stay pinned at 056d065f… (re-measured 05:35Z), so the nonce stays DJNQQ2RA and the GO pre-ruling stays as issued.

## Re-measured 05:35Z by doyle, unchanged
candidate b8482445; capture d2_capture.ps1 69b8506a…; D3 literal teardown-command.pinned 38e0f21b…; request packet 056d065f…; driver ff73a6f5…; support-manifest 357be2c9…; configuration.diff 856281a6…; cleanup-verification a5e5950b…; prep-DJNQQ2RA.ps1 98af1551…. Subject exe and firewall blobs: liam measures E at request time as before.

## Rebind reviewed and ACCEPTED as instrument-only
- Stage diff: adds `-PreflightOnly` (returns after every preflight check, before any admitted-inputs write or rig creation); removes the `Stop-Transcript` that threw on the fresh -NoProfile host (the window-2 instrument defect); adds a PREFLIGHT-phase stderr diagnostic (check name, exception type, hresult, free bytes) — bounded to the phase before any signing key exists.
- Promotion diff: `ConvertFrom-Json … -DateKind String` so date-shaped strings are not silently converted (hertz's promotion-date-discriminator proof).
- launch-scrubbed-VGCTKD7A.ps1 implements the RHSALSM6 gate exactly: removes every OWL_*/SPT_* name from the CHILD env except SPT_TEST_EPHEMERAL_ADVISORY_PORTS (+ the two SPT_RIG_PREP_* it sets by design), refuses if SPT_RELEASE_SEED or SPT_DEBUG_RELEASE_SEED remain, records names before/after without values, asserts the parent's names unchanged. Preflight-clean proof: before=[SPT_ENDPOINT_ID, SPT_RELEASE_SEED], after=[], native 0.
No candidate, capture, driver, D3, root, key/version, clock or authority-scope change.

## ADDITIONAL executor precondition (new; the RHSALSM6 standing remedy applied to the elevated leg)
The setup+t1 leg runs `env -u SPT_INSTALL_NO_FIREWALL SPT_HOME="H" E serve lan --bootstrap --port 29470` from liam's ELEVATED shell, which inherits liam's own live-agent environment; the packet says "Preserve parent identity" and nothing scrubs it. The candidate reads those names on the paths this leg exercises: OWL_SESSION_ID at crates/spt/src/api/startup.rs:1122 and api/auth.rs:61 and roster.rs:205; SPT_ENDPOINT_ID / OWL_SESSION_ID / SPT_AGENT_ID are IDENTITY_ENV_VARS at crates/spt-runtime/src/runtime.rs:45. The candidate's own e2e rigs remove OWL_SESSION_ID, SPT_ENDPOINT_ID, SPT_AGENT_ID, SPT_ADAPTER before spawning the product (crates/spt-daemon/tests/docs_server_e2e.rs:98). This is the mechanism that VOIDED the consumer legs (IR-107) and refused window 2; a third window lost to it would be the third non-candidate loss.
Required, before liam services the first request:
1. liam's elevated executor shell removes every OWL_* and SPT_* name except SPT_TEST_EPHEMERAL_ADVISORY_PORTS. (SPT_HOME is re-set by the command's own prefix; SPT_INSTALL_NO_FIREWALL is unset by it.)
2. Record env NAMES before/after — no values — to d2\VGCTKD7A-executor-env-names.json, beside the receipt.
3. Any of OWL_SESSION_ID, SPT_ENDPOINT_ID, SPT_AGENT_ID, SPT_ADAPTER, SPT_RELEASE_SEED still present when run_exactly is reached ⇒ REFUSE the leg, say so in the receipt.
This changes no pinned byte and none of the eight steps of the elevated sequence; it is executor-shell hygiene. If liam's elevation mechanism cannot scrub before the leg, HOLD and say so — do not run.

## Sequencing
Third clock opens only after: (a) liam acknowledges this r7 to hertz directly (tuple re-verified against the successor inventory, executor-env precondition accepted), and (b) hertz's live-inventory == successor-file confirmation. Same 600 s, same tuple, no reset; windows 1 and 2 stay recorded as expired/refused.